oficina / home Public

Fourth review pass: the gates would not compile, and three secrets were never loaded

The design cleared this round — the seal, the sealed link store, the
single DELETE ... RETURNING, GET-renders/POST-redeems, the
X-Forwarded-For fix, the Gate on both paths and the RP-ID rule were all
verified sound at the pin. What blocked was that the tests which ARE
the gates would not run, and the boot path never loaded most of what
it needs.

Gate 2's test could not compile. sealtest.Canaries is [][]byte, so
"canary-" + Canaries[0] is a type error; and since the ported canaries
are already address-shaped, concatenating "@example.invalid" onto one
gives a two-@ value SplitAddress rejects outright. The port now exports
CanaryAddress and the test uses it. The one test that is gate 2 has to
be the one test that runs.

Three of the four secrets were never loaded. HOME_PEPPER,
HOME_SIGNIN_KEY and the SMTP password were named in a table and created
by no step, and cmd/home/main.go was edited only to wire the database —
sheets' main.go calls LoadSealer, ours did not. There is now a
loadSecrets step, a main.go wiring step, and steps that build every
helper the later tasks use: newTestApp, signIn, capturedLink,
passkeyConfig, templateNames, renderTo, sampleData, blindIndex and the
find-or-mint upsert, plus the sealtest port the plan had already
noticed was missing and then not fixed.

The two boot refusals were prose. mail.Logged writes the address to
platform-held logs on every sign-in — §3.4's leak arriving through a
fallback nobody chose — and an empty DBPath makes SQLite open a private
temporary database, so the app works and loses every person on restart.
Both are steps now, each with its own test.

Task 7's no-script test forbade what Task 6 builds. The prose described
an allowlist by template AND by src; the code beneath it failed on any
<script> anywhere, and the executor copies the code. It now carries the
allowlist, rejects inline bodies explicitly, asserts the served CSP is
still rastrillo's default so the carve-out cannot widen into
unsafe-inline, and checks the confirm page's recovery form survives
script-stripping — which is the whole reason the exemption is the
ceremony button rather than the screen.

The RP-ID guard declared the origin as a const inside itself and
asserted it against itself, so it could not fail whatever the app
configured. By this plan's own rule that is a guard written to pass. It
reads passkeyConfig(t).Origin now, and uses HasSuffix, since Contains
accepts x.oficina.works.evil.

The renderer's owner was left as a question. Task 5 builds it minimally
— it has the first callers — and Task 7 extends it. As written neither
Task 5 nor Task 6 could execute.

Plus: static/ moves under internal/home/ because go:embed cannot reach
a parent; the schema merge targets models.go, since no db.go exists;
Task 6 gains the GET routes, ConfirmPath and a RequireFresh max age;
the link sweep drops "wake-driven", because AGENTS.md says the home
does not hibernate and there are no wakes to hang it on; the seven
utilities keep class here as they do in §11; and the merge-order note
is closed, since gate 9 and rulings 17-21 are both on main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>